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CA  Application  Performance  Management  Solution.  The  Web  is  different.  People  just  don’t  have  the  patience  for  anything  less 
than  silky  smooth,  wait-free  clicking— and  with  CA's  Application  Performance  Management  (APM)  solution  that's  just  what  you’ll 
give  them.  Because  with  a  total  view  of  your  business-critical  Web  applications,  and  a  deeper  understanding  of  your  customers’ 
actual  experience,  you’ll  make  that  experience  consistently  better.  You’ll  pinpoint  problems  at  their  root  cause— from  browser  to 
back  end— and  fix  them  before  your  customers  feel  them.  And  most  of  all,  you’ll  ensure  the  online  face  of  your  company  is  making 
you  look  good.  Get  the  latest  information  on  the  industry-leading  APM  solution  at  ca.com/apm. 
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6  Nortel  hopes  its  Chapter  tl  filing  18  The  Grill:  Pixel  Qi  CEO  Mary 
will  preserve  S2.4  billion  in  cash  Lou  Jepson  talks  about  One  Lap- 

for  customer  support  uses.  |  A  federal  top  Per  Child,  the  future  of  display 
judge  rules  that  a  hearing  in  a  music  technology  and  a  target  market  of 
piracy  lawsuit  can  be  streamed  7  billion  people, 

live  on  the  Internet. 

fix  three  Windows  bugs,  two  of 
which  could  damage  enterprise 
networks.  |  Problems  with  an  SAP 
project  contribute  to  a  jewelry 
chains  bankruptcy  filing. 

10  The  World  Bank  discloses 
that  Wipra  is  on  a  new-contract 
blacklist  -  just  like  fellow  offshore 
outsourcer  Satyam  is. 

■  NEWS  ANALYSIS 

12  Bartz  Looks  to 

Revive  Struggling 

jffmi  Yahoo.  Analysts  think  the 
JH"  9  new  Yahoo  CEO's  lack  of 

LI 

L  y  ' 

¥l8 

experience  could  end  up 

benefiting  the  company. 

14  Wall  Street  Crisis  Forcing 
Closer  Look  at  E-records.  The 

fallout  in  the  financial  industry  may 
finally  compel  companies  to  start 
implementing  strong  electronic 
records  retention  systems. 

34  Security  Manager's 

Journal:  Eyeing  Risks  While 
Cutting  Spending.  Mow  do 
you  cut  15%  of  your 
budget  while  keeping  jl 
the  company  secure7 

You  assess  the  risks, 
and  keep  your  fingers 

37  Career  Watch:  A  survey  finds. 

2  Editor's  Note:  Don  Tennant 

says  acasualtyoftheeconomic 
downturn  that's  less  immediate  than 
layoffs  is  the  loss  of  chances  to  share 
knowledge  and  experience. 

21  Oary  Anthes  explains  what  you 
and  Bernard  Madoff  have  in  common. 

among  other  things,  that  IT  pros  hate 
workplace  politics  -  and  love  the 
History  Channel. 
And  Virtela  Com- 
M  numcations  CEO 

Steve  King  offers 
&  r  some  advice 

A  to  would-be 

entrepreneurs. 

35  Bart  Perkins  cautions  that 
you  should  check  the  waters  before 
jumping  ship  for  a  boutique  consult- 

40  Frankly  Speaking:  Frank 

39  Shark  Tank:  A  pilot 
fish  finds  out  the  hard 
waywhyaminicom- 
puter  keeps  failing. 

security  involves  more  than  making 
another  list  of  coding  errors. 
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28  Turning 
Up  the  Heat  to 
Save  Energy 

Temperatures  are  rising  in 
online  brokerage  Scottrade's 
data  center.  And  that's  a 
good  thing. 

32  Enterprise 
Linux?  Not  So  Fast. 

The  idea  of  migrating  corporate  systems  to  Linux 
has  been  gaining  popularity,  but  some  IT  leaders 
still  find  the  business  case  dubious. 


Dontennaii 


The  Other  Casualty 


S  EACH  DAY  PASSES,  more  lives  are  being  forever 
changed.  The  economic  downturn  is  claiming  al¬ 
most  overwhelming  numbers  of  human  casualties, 
creating  devastating  losses  for  families  all  over  the 
world.  The  toll  in  terms  of  livelihoods  lost  is  staggering. 

But  another  casualty  i  According  to  Bill  Hefley,  i  lapsed,”  Hefley  explained, 
that’s  less  immediate,  but  director  of  the  MSIT-  Like  many  others  associat- 

increasingly  worrisome,  is  ITSM  program,  the  deci-  ed  with  the  IT  profession, 


celing  its  2009  BrainShare 
user  and  partner  confer¬ 
ence.  Last  week,  I  asked 
John  Dragoon,  senior  vice 
president  and  chief  mar¬ 
keting  officer  at  Novell, 
how  many  Novell  employ¬ 
ees  were  laid  off  as  a  result 
of  the  cancellation. 

"Zero,"  Dragoon  replied, 
noting  that  the  event  was 
canceled  because  of  cuts 
in  customer  travel  budgets. 
“Registration  was  track¬ 
ing  below  50%  of  normal. 


MSIT-ITSM  Web  site  on 
Dec.  23  states,  “The  MSIT 
in  IT  Service  Management 
announced  by  the  School 
of  Computer  Science  will 
not  be  offered  in  the  Fall 
of 2009,  given  the  current 
global  economic  and  finan¬ 
cial  crisis.  Any  decisions 
about  offering  a  program 
in  the  future  will  be  recon¬ 
sidered  at  a  later  date.” 


■  The  abortion  of 
theMSIT-ITSM 
program  at  CMU  is 
symptomatic  of  an 
unhealthy  loss  of 
knowledge-sharing 
opportunities. 


Gartner  said  in  a  statement 
to  SageCircle.  Gartner  also 
informed  the  SEC  that  it 
was  laying  offll7  employ¬ 
ees,  or  3%  of  its  workforce, 
but  it’s  unclear  whether  any 
of  the  layoffs  are  attribut¬ 
able  to  the  Symposium/ 
ITxpo  cancellations. 

And  then  there  was 

last  month  that  it  was  can- 


Lost  opportunities  to  gain 
knowledge  will  only  exac¬ 
erbate  the  problem  of  lost 
jobs.* 

Don  Tennant  is  Computer- 
world's  senior  editor- 
at-large.  You  can  contact 
him  at  don_tennant@ 
computerworld.com,  and 
visit  his  blog  at  http:// 
blogs.computerworld.com/ 
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ENERGY 
COSTS  DOWN, 
KARMA  UP 


Today,  datacenters  eat  up  to  30  times  more  energy  per  square  foot  than  a 
typical  office.  The  answer:  IBM  green  datacenter  and  IT  services.  They 
can  help  you  implement  a  conservation  policy  and  measure,  manage  and 
report  on  real  results  against  it.  Many  IBM  customers  have  doubled  their 
IT  capacity:  others  have  reduced  energy  costs  by  40%  or  more.  A  greener 


SYSTEMS.  SOFTWARE.  SERVICES.  FOR  A  GREENER  WORLD. 

Take  the  first  step  toward  a  greener  datacenter  at  ibm.com/green/services 
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RESPONSES  TO: 

The  9  Hottest 
Skills  for  ’09 

I  think  the  hot  skills  will  be  IT  posi¬ 
tions  that  require  face-to-face  con¬ 
tact,  Le.,  program  managers,  busi¬ 
ness  analysts,  help  desk.  SAP  work 
is  heavily  outsourced  right  now,  so 
it  will  be  difficult  to  get  into.  SAP  is 
a  specialized  skill,  so  once  your  skill 
set  is  SAP,  you  better  pray  the  com¬ 
pany  keeps  going  until  you  retire. 

■  Submitted  by:  Anonymous 

RESPONSE  TO: 

Won’t,  but  Should 

Jan.  5, 2009 

Another  reason  power  consump¬ 
tion  won’t  drop  appreciably  in  the 
average  data  center  is  that  the  ROI 
isn’t  there  soon  enough  to  make  it  a 
priority  in  today’s  economy. 

As  much  as  I  want  to  consign  it  to 
the  junk  heap,  my  aging  Exchange 
server  is  safe  in  its  rack  mounts  for 
time  being.  There’s  a  decent  busi¬ 
ness  case  for  replacement,  but  it 
isn’t  a  project  that’s  going  to  make 


it  to  the  capital  outlay  list  in  this 
environment. 

I  think  we  may  see  a  drop  in  aver¬ 
age  consumption,  as  components 
added  have  higher  efficiencies  —  but 
I  expect  that  few  systems  will  be 
retired  and  replaced  on  energy 
grounds  alone,  and  I  expect  that 
most  inefficient  systems  will  remain 
in  service  until  business  has  no  other 
choice  than  to  replace  those  systems 
or  the  economy  turns  around. 

■  Submitted  by:  pet  geek 
RESPONSE  TO: 

IT  Execs  Losing 
Ground  on 
Compensation, 

Salary  Study  Says 

Jan.  5, 2009 

Of  course  they  are.  With  the  open- 
source  movement,  everyone  ex¬ 
pects  IT  to  be  free.  You  reap  what 

■  Submitted  by:  Anonymous 

JOIN  THE  CHATTER!  You,  too,  can 
comment  directly  on  our  stories 

at  computerworid.com. 


m  Mari  Keefe 
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Charles  Nesson, 
a  Harvard  professor 
representing  the 
defendant,  asked 
for  the  live  stream¬ 
ing  so  Web  users 
could  ‘see  what’s  at 
stake’  in  the  case. 
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Short 

Tikes 


_  _  _  _  _  “the  next  public  release  for 

Microsoft  Issues  Patches  , 

For  ‘Nasty’  Windows  Bugs 

_  patch  that  was  expected  by 


Jeweler  Cites  SAP  Project 
In  Its  Bankruptcy  Filing 


issues  rotated  to  an  SAP  soft¬ 
ware  implementation  were 
partially  to  blame  for  its  move 
last  week  to  file  for  Chapter  11 
bankruptcy  protection. 


was  mostly  due  to  a  “pre¬ 
cipitous  decline  in  retail  sales, 
particularly  in  luxury  goods," 
during  the  current  recession. 

Shane  agreed  in  2005  to  buy  a 
“sophisticated  point-of-sale  and 


from  SAP  AQ  that  would  cost 
S8  million  to  S10  million  and 
could  be  rolled  out  within  a  year. 
The  rollout  took  32  months  and 


cost  S36  million.  H  said. 

When  employees  started  us¬ 
ing  system  in  September  2007, 
it  "did  not  yet  provide  accurate 


stable  and  functional"  toward 
the  end  of  2008  but  stiH  doesn't 
deliver  “the  full  functionality 
originally  contracted  for."  the 
filing  said. 

In  separate  statements, 

Shane  and  SAP  said  they 
continue  to  have  a  strong  work¬ 
ing  relationship.  SAP  said  it 
believes  “the  bankruptcy  filing 
inaccurately  summarizes  the 
implementation  and  cast  SAP 
in  an  unfair  light." 

-  CHRIS  KANARACUS. 

IDO  NEWSSERVICE 


T 


month  that  the  World  Bank 
had  put  another  India-based 
outsourcer,  Satyam  Com¬ 
puter  Services  Ltd.,  on  its 
vendor  blacklist  in  Septem¬ 
ber.  Satyam,  which  has  since 
been  hit  by  an  accounting 
scandal,  has  been  banned 
for  eight  years,  for  the  same 
reason  as  Wipro  and  for  not 
being  able  to  document  fees 
charged  by  subcontractors. 

A  World  Bank  spokesman 
said  last  week  that  the  bank 
publicly  announced  the 


Global 

Dispatches 


use  of  open-source  software 
with  an  eye  toward  halting  the 
use  of  pirated  software  and 


Vietnam  Pushes 
Open-Source  Apps 

HANOI.  Vietnam-  The  Viet- 


Barciays  to  Cut 
400  More  IT  Jobs 


0pen0ffice.org  and  the  Firefos 
browser  by  the  end  of  June. 
According  to  VietnamNet. 


LONDON  -  Barclays  PLC  last 
weak  said  it  plans  to  trim  more 
than  400  IT  suffers  in  addition 
to  the  1300  layoffs  announced 
last  Juty.  The  financial  ear¬ 


marks  by  a  company  official 
denying  that  the  outsourcer 
was  on  the  blacklist. 

The  bank  subsequently 
decided  to  identify  all  of  the 
companies  on  the  list  “in 
the  interest  of  fairness  and 
transparency,”  according  to 


Vietnam  is  aiming  for  all  am-  ! 
ployees  to  be  trained  to  use  the  ! 
applications  by  (he  end  of  20W.  I 


al  infrastructure  and  service 
delivery  wing.  The  company 
said  the  affected  jobs  will  not 
be  moved  offshore. 

Leo  King. 

Computerworld  U.K. 


S4.67  billion  to  *4.71  billion, 
for  a  year-to-year  increase  of 
11.8%  to  12.8%. 


Autonomy 

Dominates 
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With  1 7,000  customers  across  all  sectors  and  many  of  the  world’s  largest  software 
companies  building  their  products  on  Autonomy  technology,  Autonomy  is  the  undisputed 
leader  in  pan-enterprise  search.  Find  out  why  so  many  rely  on  Autonomy’s  Meaning  Based 

Computing  to  maximize  value  and  productivity  from  their  corporate  information  assets. 

Global  enterprise  information  infrastructure: 

Over  500  advanced  automated  functions: 

•  1000+ file  formats 

•  Conceptual  search 

•  400+  repositories 

•  Implicit  query 

•  Mapped  security 

•  Clustering 

•  SharePoint  governance 

•  Profiling 

•  FRCP  compliance 

,  •  Personalization 

•  Scalable  and  extensible 

•  Sentiment  analysis’ 

•  Language  independence 

•  Audio  and  video  processing 

“Autonomy  won  the  *  *. 

enterprise  search  wars"  'V 

Autonomy  •* 


www.autonomy.com 
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Bartz  Looks 
To  Revive  : 
Struggling 
Yahoo 

Analysts  say  that  the  new 
CEO  could  rekindle  talks  Ji 
with  Microsoft.  By  Sharon  ■' 

Gaudin  and  Stephen  Lawson  « 


Dan  Olds,  an  analyst  at 
Gabriel  Consulting  Group 
Inc.,  speculated  that  the 
change  in  leadership  could 
lead  to  a  resumption  of  talks 
between  Yahoo  and  Micro¬ 
soft  about  a  merger  or  other 


tial  deal  and  evaluate  it  on 
its  business  merits,"  he  add¬ 
ed.  The  previous  manage¬ 
ment  team,  he  said,  appeared 
“much  more  interested  in 
remaining  independent  from 


£#  I  wouldn't 
■■have  taken 
the  job  if  I  didn’t 
believe  there’s  a 
huge  opportunity 
here.  I  just  see 
[Yahoo]  as  a 
company  with 

sets  that,  frankly, 
could  use  a  little 
management. 


THE  ROAD  TO 

3"  HIGHER 

AVAILABILITY 


When  You 
,  Need  It  Most 


SunGard  Availability  Services  help  your  business  move  forward  with 
the  most  advanced  and  widest  choice  of  information  availability  options 
in  the  industry 

From  virtualization  to  hot  sites  to  replication  and  vaulting— SunGard  Availability  Services 
does  it  all.  And  it's  all  we  do.  That  kind  of  focus  helps  ensure  high  availability  of  data, 
applications  and  systems  and  fits  your  needs  and  budget  precisely. 

When  we  partner  with  you,  you  worry  less  about  the  road  ahead.  Here's  why: 
a  track  record  of  100%  successful  recoveries;  over  60  facilities  with  redundant 
power  connected  to  SunGard's  secure  global  network;  and  more  than  20,000  end- 
user  positions  in  facilities  across  North  America  and  Europe.  SunGard  Availability 
Services— the  information  availability  solution  for  businesses  that  must  run  non-stop. 
Keep  moving,  call  1-800-468-7483  or  visit  www.availability.sungard.com. 

SUNGARD’  522, 

Availability  Services  Connected? 
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Wall  Street  T 
Crisis  Forcing  « 
Closer  Look  =s 
At  E-records  § 

Banks  must  implement  strong  observ< 
data-retention  systems  as  oversight  [®cords 
increases.  By  Lucas  Mearian  decade 


AWARDS  PROGRAM 


Submit  your 
nomination  today. 

Storage  Networking  World  (SNW),  in  conjunction  with 
Computerworld  and  the  Storage  Networking  Industry 
Association  (SNIA),  is  seeking  IT  user-organization  case 
study  submissions  for  its  “Best  Practices  in  Storage" 
Awards  Program. 

Eligible  nominees  are  exclusively  IT  end-user 
organizations.  Nominations  of  IT  end-user  organizations 
are  accepted  from  IT  users  themselves,  their  public 
relations  representatives,  or  vendors  on  behalf  of  their  IT 
end-user  customers.  Multiple  submissions  of  case  studies 
describing  different  deployments  per  IT  end-user/ 
organization  will  be  considered. 

Five  finalists  in  each  category  will  be  recognized  at 
Storage  Networking  World,  April  6-9, 2009,  at  the  Rosen 
Shingle  Creek  in  Orlando,  Florida.  The  top  honoree  in 
each  category  will  be  recognized  on  the  main  stage  during 
the  SNW  Awards  Ceremony.  All  finalists  will  be 
recognized  on  the  event  website,  in  an  event  press 
release,  and  may  be  featured  in  a  special  supplement 
of  Computerworld  magazine. 


The  deadline  to  submit  a  nomination: 

Friday,  February  9,  2009 

To  submit  or  for  more  information,  visit: 

bestpractices.computerworld.com/2009/snw 


The  terra  firma 
for  IT  vertigo. 


?  £ 


11  those  competing  information  requests  can  make  you  dizzy. 

e  CEO  needs  to  know  P&L  performance  by  business  unit.  The  CFO  needs  to  know  he’s  meeting  compliance 
regulations.  And  a  dozen  business  managers  need  to  know  how  to  increase  output  but  not  staff. 

Trying  to  help  them  all  isn’t  easy.  But  it  could  be  easier  —  with  IBM  Cognos  8  Business  Intelligence,  pan 
af  IBM’s  Information  on  Demand  solutions  for  business  optimization.  With  Cognos,  you  can  minimize 
:ompeting  requests  by  empowering  users  to  easily  find  what  they  need.  And,  with  our  open,  Web-based  SOA, 


added  value  of  expertise  and  best  practices  with  industry-specific  blueprints  and  BI  Competency  Center 
development  —  which  means  you’ll  always  stay  on  solid  footing. 


Proceed  with  confidence.'" To  find  out  how  our  NEW  IBM  C 


•4  solution  can  help  your  business  us 


k 
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Mary  Lou  Jepsen 

Pixel  Qi’s  CEO  talks  about 

One  Laptop  Per  Child,  the 
future  of  display  technology 
and  a  target  market  of  7  billion. 


Dossier 


Philosophy  in  a  nutshell: 
“When  people  tell  you  some¬ 
thing  is  impossible,  what  they 
are  really  saying  is  that  it’s 
an  interesting  project.” 

Most  interesting  place  she  has 
ever  visited:  “As  a  freshman 
in  college,  the  holography  lab. 
It  absorbed  the  next  decade  of 


Favorite  nonwork  pastimes: 
“What's  that?  Outside  work? 
It  will  be  a  while...  but  seein 
friends,  kayaking,  bike  riding. 


iu  gained  worldwide  recognition 
iur  work  with  0LPC.  How  are  yo 
g  these  technologies  further  wit 
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Breakaway  IT  Leadership 
Competing  on  the  Edge 
of  Innovation 

Attend  Computerworld's  Premier  100  IT  Leaders  Conference, 
the  only  executive  conference  where  you  can  hear  from — anc 
network  with — Computerworld's  Premier  100  IT  Leaders  and 
Alumni.  They  are  unique,  award-winning  IT  executives  with 
valuable  lessons  to  share,  advice  you  can  use,  and  peer 
relationships  available  for  you  to  foster.  Here's  what  you  cai. 
expect  them  to  talk  about  in  conference  sessions: 

•  Investing  Wisely  in  Next-Gen  Strategies  and  Technologies 

•  Advancing  Business  Value  and  a  Greener  Enterprise 

•  Enabling  Smarter,  Faster  Business  Decisions  Via  Web  2.0 

•  Fine-Tuning  the  Global  Architecture  and  Reducing  IT  Costs 

•  Ensuring  Global  Operational  Excellence  24/7 

•  Creating  a  Destination  IT  Workplace:  Lessons  Learned 
from  the  Best  Places  to  Work  in  IT 
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■  THE  GRILL  MARY  LOU  JEPSEN 


r  The  fact 

I  that  we 
have  a 
plateau  today  really 
suggests  that  it’s 
time  for  something 
radical  and  new. 


Continued  from  page  18 
have  driven  the  power  consumption 
down.  We  are  working  on  intertwining 
the  display  with  the  CPU  and  mother¬ 
board  to  dramatically  further  lower 
the  cost  and  vastly  prolong  the  battery 


the  future  of  portable  computing  is  all  The  holodeck  is  possible,  but  not  yet 
about  the  screen.  totally  possible.  It  will  take  a  while  to 

Look  at  an  iPhone;  all  you  see  is  the  debug  it  —  many  years,  I  suspect.  But 


technologies  and  materials  takes  many 
years  and  billions  of  dollars.  OLEDs 
and  electrophoretics  were  promised  in 
high-volume  mass  production  a  decade 
ago  and  still  attain  annual  volumes  of 
less  than  1  million  units  a  year,  with 
quality  and  reliability  that  fall  well 
short  of  what  mature  markets  demand. 

I  think  that  we  just  need  to  look  to 
the  history  of  silicon  technologies  to 
see  the  future  of  display.  About  two 
decades  ago,  there  were  many  different 
electronic  technologies.  [Then]  CMOS 
became  good  enough,  and  everyone 
moved  to  it,  except  for  niche  applica¬ 
tions.  A  similar  shift  has  occurred  in 
displays.  Today  it’s  nearly  all  LCD. 

Behind  the  scenes,  the  manufactur¬ 
ing  infrastructure  of  TFT  [thin-film 
transistor]  LCD  today  dwarfs  that 
of  foundry  silicon,  shipping  about 
$100  billion  [worth]  per  year.  I  believe 
that  we  need  to  leverage  this  infra¬ 
structure  in  new  ways  to  make  new 
displays,  but  without  changing  the 
manufacturing  processes  or  materials 


we  started  at  One  Laptop  Per  Child 
at  Pixel  Qi  by  making  screens  for  the 
broader  market  rather  than  for  just 
one  laptop  model  as  I  did  at  OLPC. 
Why?  This  allows  much  bigger  reach. 
Paradoxically,  spinning  out  of  OLPC 
was  the  best  way  I  could  think  to 
continue  to  help  OLPC,  because  by 
making  more  of  something,  you  can 
make  it  less  expensive.  Less  expensive 
laptops  would  allow  more  children  ac¬ 
cess  to  them. 

Pixel  Qi,  of  course,  is  a  for-profit 
corporation.  But  let’s  remember  the 
immense  scale  of  the  opportunity 
when  you  realize  that  all  nearly  7  bil¬ 
lion  people  on  Earth  can  be  your  target 

Do  you  have  any  advice  for  young  inven¬ 
tors  in  the  computer  industry?  It’s  too 
easy  to  accept  that  because  the  defini¬ 
tion  of  computing  today  seems  pretty 
stable  and  standard,  that  therefore  we 
now  have  what  we  are  going  to  have. 
The  fact  that  we  have  a  plateau  today 


Longer  term,  we  are  developing  new  processes  to  compete  with  this  thing  radical  and  new. 

products  for  2010-2011  where  we  can  immense  and  mature  infrastructure.  Actually,  the  “bottom  of  the  pyra- 

completely  remove  the  backlight  from  we  follow  and  partner  with  the  manu-  mid”  is  a  good  place  to  start  looking  for 

the  LCD  in  laptops.  These  displays  facturers'  development  road  map  and  an  entirely  new  way  to  define  comput- 

will  be  bright  and  colorful  in  room  create  truly  innovative  displays  that  ers.  What  is  the  computer  platform 

light  and  bright  sunlight  They  will  be  can  ship  in  high  volume  and  at  low  that  could  serve  all  adults  on  Earth 

easy  to  read  and  offer  ultralow  power  cost  quickly.  rather  than  the  1  billion  or  so  that  now 

consumption  —  less  than  1%  of  current  This  is  what  I  was  able  to  do  at  One  have  access? 

LCD  power  consumption.  Laptop  Per  Child,  and  this  is  the  trail  —  Interview  by  Sara  Forrest, 

we  continue  to  blaze  at  Pixel  Qi.  a  freelance  photographer 

What  do  you  think  displays  will  look  like  and  writer  in  New  York 

In  free  years?  Ton  years?  I  think  that  Will  we  ever  join  Speck  in  the  holodeck?  (saraforrestphoto@gmail.com) 
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Gary  Anthes 

Out  With  the  Old, 
In  With  the  New 


few  users,  all  saying  they 
have  a  better  idea.  Indeed 
the  IT  manager  needs 


ATE  LAST  YEAR,  just  when  it  seemed  that  every  says  new  things  and  risk- 

slimy  rock  on  Wall  Street  had  already  been  turned  ta ^ 

over,  came  news  of  the  Mother  of  All  Ponzi  Schemes  finds  that  changing  to  the 


—  the  apparent  disappearance  of  $50  billion  at  the 
hands  of  Bernard  Madoff. 

The  mind  boggles  at  such  sums.  And  yet,  that’s  small 

potatoes  compared  to  the  i  “leverage”  (debp  were  in  i  The  history  of  IT  sinci 


than  anyone  expected  and 
that  not  all  the  promised 
benefits  are  realized.  But 


tution  and  to  society.  But 
mortgages  were  packaged 
and  sold,  and  then  repack¬ 
aged  and  resold  again 


nor  their  sellers  complete¬ 
ly  understood  them. 

But  so  what?  Risk  and 


■  What  do  you 
have  in  common 
with  Bernard 
Madoff  and  the 
Wall  Street  man¬ 
agers  who  bought 
those  mortgage- 
backed  securities? 


computing  infrastructure 
in  place  for  his  company. 

It  works  OK,  maybe  better 
than  the  last  thing  he  had, 
but  of  course  it  does  have 
some  problems.  Onto  the 
stage  stride  the  vendors, 
the  analyst  blowhards,  a 
few  peers  and  maybe  a 


—  a  good  year  to  invest  in 
training,  procedures,  doc¬ 
umentation  and  other  bor¬ 
ing  things.  Then,  by  2010, 
you'll  be  ready  for  the  next 
silver  bullet.  ■ 

Gary  Anthes  is  a  Computer- 
world  national  correspon¬ 
dent.  You  can  contact 
him  atgary_anthes@ 
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TIMES 

Nine  ways  to  get  more  out  of 
software  vendors  in  2009. 

BY  THOMAS  HOFFMAN 


wants  to  reduce  the  number  of  seats, 
some  vendors,  including  SAP  AG  and 
Oracle  Corp.,  typically  respond  by 
raising  the  price  per  seat,  says  Wang. 
The  net  result:  You  pay  the  same  and 
get  less. 

Although  both  SAP  and  Oracle 
tend  to  be  fairly  rigid  about  lowering 
the  number  of  user  seats  in  software 
agreements,  there  are  techniques  you 
can  use  to  get  around  this  problem 
with  other  vendors.  For  instance, 
since  July,  Schleiden  and  his  team 
have  worked  with  approximately  300 
of  YRC’s  software  vendors  to  see  if  it 
would  be  possible  to  “park"  unused 
seat  licenses  until  the  economy  im- 


COVER  STORY 


says  Wang,  so  before  you  sign,  make 
sure  you  completely  understand  the 
terms  of  pricing  and  use  them  to  your 
advantage.  “It’s  more  cost-effective  to 
flex  up,"  he  says. 

That  means,  for  example,  that  a 
customer  with  1,000  users  should  ne¬ 
gotiate  hard  for  the  first  500  seats  at 
the  onset  of  contract  negotiations  and 
then  add  sets  of  100  more  licenses  as 
needed.  Wang  says. 

4  ASK.  AND  YOU 

SHALL  RECEIVE. 

In  light  of  the  economic 
crunch,  some  vendors  are  coming 
up  with  creative  financing  to  entice 
would-be  customers  to  sign  deals, 
says  Schleiden.  If  they  don’t,  you 
should.  “We  have  a  list  of  side  perks 
we  typically  ask  the  vendor  for,”  says 
Schleiden.  These  include  cost  caps 
on  future  maintenance  and  licensing 
increases,  and  free  first-year  mainte¬ 
nance.  “We've  never  been  successful 
in  getting  them  all,  but  we  typically  get 
several,”  he  says 

Never  hesitate  to  ask  vendors  for 
concessions,  says  Gartner  Inc.  ana¬ 
lyst  Jane  Disbrow.  During  the  course 
of  contract  negotiations,  software 
vendors  will  typically  go  through  a 
discounting  process  “that  leads  the 
customer  to  believe  that  [the  sales¬ 
people]  won’t  be  able  to  feed  their  own 
children  tomorrow  because  they  gave 
them  such  a  great  deal,"  she  says. 

But  don’t  worry  about  the  vendors. 
They  “always  tend  to  hold  back  money,” 
Disbrow  says.  Your  goal  should  be  to 
not  leave  any  of  that  money  on  the  table. 


DRIVEAHARD 

BARGAIN 


INTERNATIONAL  COMPUTER 
NEGOTIATIONS  INC.  provides  a 
comprehensive  software  licensing 
agreement  checklist  that  you  can 
access  online  at  mm.dobetterdeals. 
com/swchecklist.  Among  those  tips 
is  that  any  software  licensing  agree¬ 
ment  should  identify  the  applicable 
parts  of  any  collateral  material  that 
helped  you  choose  the  vendor  or 
in  which  the  vendor  “promises"  to 
meet  your  needs.  Examples  include 
marketing  materials,  portions  of  your 
request  for  proposals,  the  vendor's 
proposal  and  correspondence. 

ICN  also  suggests  that  a  software 
license  agreement  should  include  the 
following  provisions: 

■  It  should  state  that  no  payment  is 
required  until  you  receive  the  goods 
or  services. 

■  It  should  allow  a  sufficiently  broad 
scope  of  use  for  the  software.  A  lim¬ 
ited  scope  of  use  is  the  leading  cause 
of  higher  license  fees. 

■  The  agreement  should  allow  cer¬ 
tain  parties  other  than  the  original 
licensee  to  use  the  software.  Such 
parties  include  subsidiaries,  the  par¬ 
ent  company  or  parties  involved  in  a 
merger  or  acquisition. 

■  The  license  grant  should  be  broad 
enough  to  cover  usage  rights  even  if 


you  don’t  opt  for  maintenance. 

■  You  should  receive  the  right  to  use 
the  source  code,  modify  it  and  create 
derivative  works  from  it. 

■  If  you  are  acquiring  an  application 
that  isn't  an  off-the-shelf  product, 
you  should  have  the  right  to  test  and 
accept  the  software  before  any  pay¬ 
ment  obligation  is  triggered. 

■  Under  the  term  and  termination 
provision,  your  term  of  use  should  in¬ 
clude  the  acceptance-testing  phase, 
and  your  right  to  terminate  before  the 
expiration  date  should  begin  prior  to 
final  acceptance. 

■  The  contract  should  state  what 
recourse  is  available  to  you  if  the 
vendor  guarantees  something  but 
doesn't  deliver. 

■  The  vendor  should  guarantee  that  it 
will  fulfill  its  tax  responsibilities. 

■  The  vendor's  liability  limits  should 
be  consistent  with  the  magnitude 
of  the  deal.  Normal  vendor  liability- 
limitation  provisions  severely  restrict 
the  amount  of  protection  you  receive 
from  the  vendor. 

■  You  should  be  able  to  terminate  the 
agreement  for  any  material  breach 
by  the  vendor  if  it  doesn't  address  the 
problem  in  an  agreed-upon  period 

of  time. 

-  THOMAS  HOFFMAN 
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PHANTOM  SYSTEMS. 

During  the  cost-cutting  drive 
at  Sony  Pictures  Home  Entertainment, 


just  would  have  gone  through,”  he  says. 


6 


PUT  MAINTENANCE 
UNDER  A  MICRO¬ 
SCOPE. 


that  vendors  don't  want  to  haggle 
"Maintenance  is  the  last  thing  [ve 
dors]  want  to  discount,”  he  says. 

But  there  are  always  exceptions 
example,  under  most  vendor-gene 


Mediterranean  Shipping  Company 
discovered  a  new  form  of  energy. 


Mediterranean  Shipping  CoiT)^rty  #sflSQ  15  the  second  largest 
container  ship  line  in  the  world,  with  a  database  that  trac&ftfoft' 
than  210  billion  transactions  a  year  The  company  recently  upgrac 
Its  database  to  Microsoft  SQL  Server  2008,  not  only  to  handle  tf 
massive  liatdybut  aiso  to  simplify  MSCs  database  administration 

for  MSC.  See  the  whole  story  at  SQLServerEnergy.com 

SQLServer 


charge.  Though  he,  too,  is  not  always 
successful,  he  says  that  “lately,  the 
percentage  [of  vendors  that  concede]  is 
higher  than  it’s  been  in  the  past," 
Schleiden’s  IT  procurement  group 
also  tracks  the  number  of  software 
maintenance  calls  it  puts  out  to  each 
of  its  suppliers  annually  to  make  sure 
YRC  is  getting  its  money’s  worth. 

Last  year.  Schleiden  renegotiated 


contract.  In  fact,  says  Wang,  if  you  do 
insist  on  using  your  own  “paper,"  ex¬ 
pect  to  add  three  to  six  months  to  the 
negotiation  process,  even  if  you  state 
your  intention  upfront. 

In  Disbrow’s  experience,  customers 
outside  the  public  sector  almost  always 


on  amending  them. 

“We’ve  never  signed  any  kind  of  an 
agreement  without  making  changes," 
says  Tyrone  Magby,  IT  sourcing  man¬ 
ager  at  Fiserv  Inc.  in  Brookfield,  Wis. 
Key  examples  include  the  addition  of 
indemnification  clauses  and  guaran- 
the  maintenance  terms  are 
te  net  price  and  not  the  list 
the  system,  he  says. 


ts  timetable.  “We  don’t 
nto  [meeting] 
don't  play  tha 


SWEET 

TALK 

AS  PART  OF  HIS  EFFORTS  to  cut  soft¬ 
ware  costs,  David  Cortese  has  occa¬ 
sionally  agreed  to  serve  as  a  spokes¬ 
man  for  products  his  company  uses. 

For  instance.  Cortese,  the  vice 
president  of  IT  at  Sony  Pictures  Home 
Entertainment,  agreed  to  speak  at  a 
business  intelligence  vendor's  annual 
user  conference  and  a  few  educa¬ 
tional  events.  He  also  agreed  to  be 
interviewed  for  an  article  about  Its 
products. 

In  exchange,  Cortese  received  train¬ 
ing  credits  for  his  IT  staff  and  passes 
to  the  vendor's  annual  customer  con¬ 
ference,  a  value  he  estimated  in  the 
tens  of  thousands  of  dollars. 

Cortese  says  he's  been  very  selective 
in  speaking  about  vendor  products. 
“I’ve  done  this  with  two  vendors  in 
eight  years.  H's  only  for  the  best  of  the 
best;  you  have  to  be  very  discriminat- 


they  let  the  vendor  know  they  will  be 
doing  so  in  the  request-for-proposals 
stage  of  the  deal. 

“Here’s  a  legitimate  problem  for  ver 
dors:  If  you  pull  out  your  own  contrac 


y  will  be  5%  to  10%.  To  gain  maximum  leverage, 
oposals  Auer  recommends  starting  the  process 
60  to  90  days  before  the  end  of  a  fiscal 
m  for  ven-  year,  or  30  days  before  the  end  of  a  fi- 
l  contract  nancial  quarter, 

rely  a  “Vendors  are  real  serious  about 

quickly,"  salespeople  making  their  quotas."  says 

s  lawyers  Auer.  “They  can  make  magic  things 

liliar  happen  during  those  times.”  ■ 

:ontracts  Hoffman  is  a/ormerComputerworld 

time  to  national  correspondent.  Contact  him  at 

omer’s  tom.hoffman24@gmail.com. 


that  new  functionality."  says  Zapinski. 
She  says  her  company  has  agreed  on 
occasion  to  speak  about  vendor  prod¬ 
ucts  at  conferences  but  without  any 
financial  strings  attached. 

YRC  Worldwide  officials  have  spoken 
about  products  on  behalf  of  vendors  - 
but  "infrequently  and  very  cautiously," 
says  Roy  Schleiden.  senior  manager 
of  IT  procurement  and  vendor  man¬ 
agement.  YRC  Worldwide  insists  on 
several  conditions,  but  most  important 
is  that  it  retain  complete  control  over 
what  it  says  about  the  products. 

-  THOMAS  HOFFMAN 
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rperature’s 
rising  in 
online 
brokerage 
Scottrade  Inc.’s  data 
center  —  and  that’s  a 
good  thing.  The  move 
has  allowed  the  St. 
Louis-based  company 
to  reap  enormous 
energy  savings  while 
increasing  reliability. 


# 

TURNING  UP  THE 

TO  SAVE  ENERGY 


TO  SAVE 
ENERGY 


A  few  small  changes  can 
save  data  centers  big  bucks 
on  energy  consumption, 
cutting  bills  by  25%  or 
more,  says  Samuel  Graves, 
chief  data  center  mechani¬ 
cal  engineer  at  consulting 
engineering  firm  Glumac. 


the  hottest-running  servers 
tended  to  be  mounted  at  the 
top,  where  cooling  efficiency 
was  lowest.  To  address  that, 
Scottrade  had  lowered  the 
CRAC  system  temperature 
settings,  overchilling  the 
rest  of  the  room. 

“Scottrade  was  running 
the  overall  data  center  tem- 


JANUARY  1 


It  may  look  nice  to  have  those  perfo¬ 
rated  tiles  neatly  spaced  and  aligned, 
but  it  creates  imbalances  between  the 
air  provisioned  and  the  actual  heat  load 


Ilt’s  common  to  see  very  large  holes 
cut  under  the  power  distribution 
units  and  racks  to  bring  power  and 


timizing  the  model  adds  50  cents  per 
square  foot.  "This  is  a  generalization  on 
cost,  and  obviously,  the  larger  the  data 
center,  the  lower  the  per-square-foot 
cost,"  says  Graves. 

-  ROBERT  L.  MITCHELL 


"Almost  always,  the  perforated 
tiles  in  the  cold  aisle  are  set  up 
with  an  architectural  appeal  in  mind  and 
not  the  actual  server  load,"  says  Graves. 


ACHIEVING  BALANCE 


There’s  an  optimal 
temperature  point 
where  you  want  your 
chips  runniny. 
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Glumac  tuned  Scot- 
trade’s  existing  server 
environment  to  the  CFD 
model.  "I  ensured  that  the 
right  amount  of  cold  air 
was  supplied  in  each  cold 
aisle  and  more  specifically 
in  front  of  each  rack  -  not 
too  much,  not  too  little.” 
Graves  says.  “The  raised- 
floor  perforated  tiles  were 
redistributed  in  [each  aisle 
of]  the  data  center  to  match 


tne  CFG  model  output.  In 
some  cases,  where  hiyher- 
density  servers  were  preva¬ 
lent,  grates  were  added  in 
piace  of  the  standard  perfo¬ 
rated  tiles.” 

This  airflow  balancing 
stopped  much  of  the  over- 
the-rack  recirculation  in 
the  data  center  space  and 
provided  just  the  right 
amount  of  cooling  where  it 
was  needed. 


Scottrade’s  air  con¬ 
ditioning  system  did  not 
use  an  in-ceiling  plenum 
for  hot-air  return.  Instead, 
returns  were  located  about 
five  and  a  half  or  six  feet 
from  the  floor  -  where  a 
thermocline  (a  layer  of  hot 
air)  was  identified.  Glumac 
added  two-foot  extensions 
onto  the  air  conditioning 


units.  These  extensions 
effectively  moved  the  ther- 
mociine  in  the  room  up  by 
one  and  a  half  to  two  feet 
-  above  the  tops  of  most 
of  the  racks -allowing 
equipment  in  the  tops  of  the 
racks  to  operate  in  a  better 
thermal  environment. 


Glumac  added 
blank-out  panels  in  all  va¬ 
cant  slots  in  server  racks. 
These  panels  are  a  physical 
barrier  between  the  hot  and 
cold  aisles,  ensuring  that 
air  moves  from  the  cold 
aisle  to  the  hot  aisle  and 
allowing  each  to  perform 
efficiently. 

“Large  temperature 
differentials  between  hot 
and  cold  aisles  are  critical 
to  increase  cooling  ef¬ 
ficiency,”  Graves  says. 
"Thermal  mixing  of  [hot  and 
cold  air  within]  the  server 
rack  is  a  major  reason  why 
many  data  centers  cannot 
achieve  that.” 

-  ROBERT  L.  MITCHELL 


Large  temperature  dif- 
I i  .  ferentials  between  hot 

and  cold  aisles  are  critical  to 
increase  cooling  efficiency. 

^  ^  CHIEF  DATA  CENTER 

MECHANICAL  ENGINEER.  6LUMAC 


NEWER  AND  HOTTER 


COMPUTERWORLO 


HOW  THEY  DID  IT 


After  creating  a 
computational  fluid 

Scottrade's  data 
center,  Samuel 

center  mechanical 
engineer  at  Glu- 
mac,  was  able  to 
identify  the  key 
problem  areas.  Then 
these  three  basic, 
inexpensive  changes 
helped  Scottrade  cut 

by  8°/o,  increase 
cooling  efficiency 
and  improve  equip¬ 
ment  reliability  in  its 
data  center. 
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Linux? 

Some  still  find  the  business  case 
dubious.  By  Robert  L.  Mitchell  ■ 


applications  from 
high-end  Unix-based 
systems  such  as 
Sparc  Solaris  to  com¬ 
modity  x86/  Linux 
is  has  been  a  popular  idea  for 
the  past  few  years,  but  not  everyone 
thinks  going  full-on  with  Linux  is  the 
best  solution  —  at  least  not  yet. 

Dan  Blanchard,  vice  president  of 
enterprise  operations  at  Marriott  In¬ 
ternational  Inc.,  is  serious  about  Linux. 
He  says  his  company’s  transition  from 
high-end  Unix-based  systems  from 
Hewlett-Packard  Co.  and  IBM  is  ongo¬ 
ing  —  and  inevitable.  “We’re  migrat¬ 
ing.  and  we  have  a  strategy  to  continue 
deployment  of  Linux,"  he  says. 

Tony  lams  hears  that  refrain  from 
IT  executives  frequently.  “Companies 
have  had  a  long-term  goal  of  con¬ 
solidating  all  of  their  Unix  systems 
onto  Linux,”  says  lams,  an  analyst  at 
research  firm  Ideas  International  Ltd. 
The  companies  want  to  consolidate  on 
i  nd  u  st  ry-st  a  nda  rd  tech  nology  across 
the  board,  he  says,  and  that  means 
Linux  running  on  x86  hardware. 

But  Norm  Fjeldheim,  CIO  at  Qual¬ 
comm  Inc.,  decided  to  take  a  pass  on  a 
Solaris-to-Linux  migration.  The  com- 
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LINUX  IS  A 


CONTENDER 


Would  you  consider  changing  the 
operating  system  your  most  impor¬ 
tant  packaged  applications  run  on? 


Which  operating  system 
would  you  consider? 


BASE:  249  RESPONDENTS  WHO  SAID 


pany  does  use  Linux  for  some  applica¬ 
tions.  but  Fjeldheim's  IT  team  conclud¬ 
ed  that  migrating  its  industrial-grade 
Solaris  systems  to  Linux  was  a  dubious 
business  proposition.  "We’re  not  mov¬ 
ing  from  Sun  to  Linux.  We  haven’t 
been  able  to  make  the  economic  case 
for  it,”  he  says. 

While  it  appeared  at  first  glance  that 
Qualcomm  would  save  money  upfront 
on  hardware  and  operating  system 
costs  by  migrating,  the  price  compari¬ 
sons  offered  by  vendors  were  based  on 
retail  prices.  "We  don't  pay  retail,  [and] 
when  we  figured  our  discounts  [with 
Sun  Microsystems],  the  price  advan¬ 
tages  went  away  for  Linux  pretty  fast," 
Fjeldheim  says. 

And  that  wasn’t  the  only  issue.  His 
team  wasn't  satisfied  with  the  quality 
of  the  administrative  tools  available 
for  the  Linux  environment.  At  the  time 
Qualcomm's  IT  staff  did  the  assess¬ 
ment  —  some  18  months  ago  —  the 
things  that  make  an  administrator's  job 
easier  “really  didn't  exist  to  the  same 
degree  in  Linux  as  they  did  on  Unix- 
based  systems."  Fjeldheim  says.  And 
that,  he  adds,  would  have  translated 
into  larger  administrative  costs. 

As  director  of  IT  at  Qualcomm. 
Matthew  Clark  was  part  of  the  team 
that  reviewed  the  Linux  option.  The 
company's  ratio  of  administrators  to 
users  is  currently  500-to-l  (although  he 
plans  to  lower  that  to  about  450-to-l ). 
“With  Linux,  it  would  have  been  1501 
or  175-to-l.  We  would  have  had  to  hire 
three  additional  administrators  for 
every  administrator  we  have  right  now 
working  on  Unix,”  he  says. 

lams  isn’t  surprised  to  hear  that  as¬ 
sessment.  “That’s  traditionally  been  one 
of  Sun's  strong  points,"  he  says.  "They’ve 
optimized  their  systems  for  that  metric." 

Clark  acknowledges  that  the  admin¬ 
istrative  tools  have  improved  since 
Qualcomm  last  reviewed  its  Linux  op¬ 
tions,  but  he  still  thinks  Linux  would 
be  more  costly.  “If  we  started  today 
with  the  new  [tools]  coming  out,  we 
might  be  in  the  neighborhood  of  two 
[admins]  for  every  one,”  he  says. 

Although  the  numbers  didn't  add 
up  for  Linux  as  a  Solaris  replacement. 
Clark  said  he’s  impressed  with  Linux's 
overall  capabilities  and  believes  the 
operating  system  will  continue  to  have 
a  place  at  Qualcomm.  “We  like  the 
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Linux? 

NOT  SO  FAST. 

Some  still  find  the  business  case 
dubious.  By  Robert  L.  Mitchell  | 


ing  from  Sun  to  Linux.  We  haven’t 
been  able  to  make  the  economic  case 
for  it,”  he  says. 

While  it  appeared  at  first  glance  that 
Qualcomm  would  save  money  upfront 
on  hardware  and  operating  system 
costs  by  migrating,  the  price  compari¬ 
sons  offered  by  vendors  were  based  on 
retail  prices.  “We  don’t  pay  retail,  [and] 
when  we  figured  our  discounts  [with 
Sun  Microsystems],  the  price  advan¬ 
tages  went  away  for  Linux  pretty  fast," 
Fjeldheini  says. 

And  that  wasn’t  the  only  issue.  His 
team  wasn’t  satisfied  with  the  quality 
of  the  administrative  tools  available 
for  the  Linux  environment.  At  the  time 
Qualcomm’s  IT  staff  did  the  assess¬ 
ment  —  some  18  months  ago  —  the 
things  that  make  an  administrator's  job 
easier  “really  didn’t  exist  to  the  same 


Linux  running  on  x86  hardware. 

But  Norm  Fjeldheim,  CIO  at  Qual¬ 
comm  Inc.,  decided  to  take  a  pass  on ; 
Solaris-to-Linux  migration.  The  com- 


I  Clark  said  he’s  impressed  with  Linux's 
£  overall  capabilities  and  believes  the 
I  operating  system  will  continue  to  hav< 
I  a  place  at  Qualcomm.  “We  like  the 


NOT  FOR  EVERYONE 

Blanchard  agrees  that  Linux  doesn’t 
work  for  every  applica-  ■— 
t  ion.  In  some  cases,  he  M  M  Vi 

has  seen  Marriott’s  IT  ^ 

team  look  at  a  Linux  mi-  j 
gration  and  decide  not  , 

to  proceed.  a  strate 

Overall,  the  applica-  COntlllUl 

tions  moving  to  Linux  ITIfint  01 

at  Marriott  tend  to  be  OAN  BLANC 

high-end  Unix  sys-  PRESIDENT  0 

terns,  he  says,  and  the 
Linux-based  tools  that  TERNATONAI 

are  replacing  them  are  mm  yo 

sufficient  for  Marriott’s  ** 

needs.  "We  started  talk-  ?  ^ 

ing  about  enterprise- 
class  Linux  systems  10  ttaVBfl  I 

years  ago.”  Blanchard  to  make 

says.  “It  took  a  while  to  llOmiC  C 

get  that  up  and  running.”  NORM  FJELI 

It  also  helps  that  QUALCOMM  II 

Marriott’s  IT  vendors  L_ 
are  supporting  the  initiative.  Rather 
than  trying  to  persuade  the  hospitality 
company  to  stay  on  Unix  systems  and 
high-end  server  hardware,  both  IBM 
and  HP  have  been  helping  to  make 
those  migrations  go  smoothly.  “Our 


■■  migrating, 
and  we  have 
a  strategy  to 
continue  deploy¬ 
ment  of  Linux. 

OAN  BLANCHARD.  VICE 
PRESIDENT  OF  ENTERPRISE 
OPERATIONS.  MARRIOTT  IN¬ 
TERNATIONAL  INC. 

M  We’re  not 
moving  from 
Sun  to  Linux.  We 
haven’t  been  able 
to  make  the  eco¬ 
nomic  case  for  it. 


talk  about  potentially  using  its  virtualiza¬ 
tion  technology,  and  he  began  to  experi¬ 
ment  with  Solaris  Containers.  "We’re 
in  the  middle  of  that  now,"  he  says. 
Sun’s  Containers  technology,  which 
— ■  creates  virtual  machine 
|-g  instances  that  share 

rating  a  sins|e  c°py  °f  the 

iyg  ’  operating  system,  can 

»  make  for  a  compelling 

fonlnv-  economy-of-scale  ar- 

lepioy-  gument,  lams  says.  It 

inUX.  can  scale  much  better 

RD.  VICE  than  VMware,  it’s  more 

NTERPRISE  mature  than  Parallels' 

iRRIOTT  IN-  Virtuozzo,  and  it’s  sup- 
...... _  ported  by  Sun  as  part 

re  not  of  the  core  °Peratin& 

■  system.  With  Contain- 

S  Wp**  ers’ he  says'  "you  have  a 

U*"  kl  much  smaller  footprint 

sen  able  per  instance,  so  you  get 
lie  eco-  a  much  higher  level  of 

>e  for  it.  consolidation.  While 

EIM.  CIO.  you  might  [have]  a  few 

dozen  [VMs  per  physi- 
— — 1  cal  server]  with  VM¬ 
ware,  with  Containers  it’s  hundreds 
—  or  even  thousands  —  per  server." 

Smith  saw  enough  of  a  benefit  from 
Containers  to  change  his  plans,  but 
he’s  still  keeping  Linux  in  the  pic¬ 
ture.  “We  won't  be  as  aggressive  in 


Here's  another  way  you  can  become 
more  productive  IBM  System  x3500 
Express  affordably  manages  your  IT 
network  Irom  one  location.  Identifies 
potential  problems  before  they  happen 
and  keeps  your  downtime  to  a  minimum. 
It's  innovation  made  easy. 


Up  to  8  hot-swappable  SAS  or  SATA  HDDs 
or  up  to  12  hoi-swappable  SFF  SAS  or  SATA 
HDDs  to  support  large  capacity 


vendors  are  very  comfortable  with  this  replatforming  to  Linux  as  we  initially 
transition,”  Blanchard  says.  thought,"  he  says. 

For  now,  however,  Unix  systems  are  But,  he  adds,  “we  feel  that  both  plat 
still  very  much  in  the  mix  as  Marriott  forms  will  have  a  place  in  our  infra¬ 
plans  migrations  on  a  case-by-case  structure.”  ■ 
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I  SECURITY  MANAGER’S  JOURNAL  MATHIAS  THURMAN 


Eyeing  Risks  While 
Cutting  Spending 


How  do  you  cut  15%  of  your  budget  while 
keeping  the  company  secure?  You  assess 
the  risks  and  keep  your  fingers  crossed. 


WE’RE  STILL 
dealing  with 
fallout  from 
the  weakening 
economy.  Besides  the  mas¬ 
sive  layoff  I  wrote  about 
last  time,  each  department 
has  been  told  to  decrease 
spending  by  15%. 

My  job  as  a  security 
officer  is  to  ensure  the  con¬ 
fidentiality.  integrity  and 
availability  of  our  systems 
and  intellectual  property, 
and  my  budget  was  fairly 
limited  already.  So  there 
wasn’t  much  I  could  do  to 
further  cut  expenses  with¬ 
out  putting  the  company  at 
serious  risk.  Nonetheless, 

I  did  a  risk  assessment  and 
came  up  with  the  follow¬ 
ing  cutbacks. 

First  up  is  intrusion 
detection.  Our  12  sensors 
are  positioned  to  monitor 
the  DMZs  at  corporate 
and  remote  offices  as  well 


signatures  than  we  need  to. 
Our  analysts  spend  a  good 
part  of  their  days  chasing 
false  positives. 

When  we  had  more  re¬ 
sources,  that  didn't  seem 
like  a  big  deal,  but  now  it’s 
looking  like  an  area  of  po¬ 
tential  savings.  I'm  going 
to  tune  the  rules  so  that  we 
can  decrease  the  offshore 
head 


Them 


form  of  SecurlD  tokens. 
Until  now,  our  company 
has  issued  the  hard  (key 
fob)  tokens.  There  are  cur¬ 
rently  more  than  5.000  to¬ 
kens  deployed  worldwide. 
These  tokens  have  bat¬ 
teries  that  last  only  a  few 
years,  and  then  new  tokens 

With  software  tokens, 
we  can  eliminate  the  need 
for  those  hardware  re¬ 
placements  and  the  cost  of 
shipping  fobs  to  our  users 


around  the  world.  They 
are  easier  to  deploy,  and 
there  aren’t  any  batteries. 

The  drawback  is  the 
threat  of  keystroke-capture 
programs.  Since  the  physi¬ 
cal  tokens  are  separate 
from  the  computers, 
they’re  not  susceptible  to 
keystroke  capture  being 
used  to  obtain  a  user's  PIN. 

It’s  a  risk  we’re  going  to 
have  to  take,  and  we  may 
be  able  to  get  users  to  en¬ 
ter  their  PINs  by  pointing 
their  mice  to  on-screen 
number  pads,  which  would 
mitigate  the  keystroke- 
capture  threat.  An  added 
benefit  is  that  the  software 
tokens  can  be  used  on  mo¬ 
bile  devices. 


LONG-DISTANCE  AUDIT 

Other  savings  will  come 
from  altering  my  audit 
schedule  from  twice  to 
once  a  year.  This  saves 


Trouble 

Ticket 


ACTION  PUN:  Do  a 


Risking  a  vulnerability  in 
order  to  save  money  would 
be  foolhardy  -  and,  in  the 


on  some  of  our  commer¬ 
cial  scanning  tools.  PU 
keep  IBM’s  ISS  Scanner 
for  servers  and  Hewlett- 
Packard’s  Weblnspect  for 
applications,  but  we  can 
use  open-source  tools  to 
fill  in  the  gaps.  Nessus 
has  always  served  me 
well,  and  the  open-source 
version  can  stand  up 
nicely  to  the  commercial 
equivalents.  And  there  are 
plenty  of  Web-based  ap¬ 
plication-scanning  tools, 
such  as  Nikto  or  Google’s 
Ratproxy.  They  may  lack 
the  bells  and  whistles  of 
commercial  equivalents, 
but  they  do  the  job. 

I  doubt  I'll  be  able  to  get 
to  that  15%  figure  with¬ 
out  pulling  out  firewalls 
and  VPN  concentrators. 
But  doing  things  like  that 
is  riskier  than  the  other 
things  I  outlined  above. 

I’m  never  happy  about 
having  to  make 


curity  budget,  O  JOIN  IN 
of  course,  but 

this  economic  ^ 
downturn  will 


about  security. goto 


as  major  data  centers  and 
some  interoffice  communi¬ 
cations.  We're  using  several 
offshore  analysts  to  moni¬ 
tor  those  sensors:  they  at¬ 
tend  to  the  alerts  and,  when 
necessary,  escalate  things 
to  our  analysts  here  in  the 
U.S.  for  evaluation  and  ac¬ 
tion.  But  we’re  definitely 
monitoring  more  attack 


■  I’m  never  happy 
about  having  to 
make  cuts  in  the 
security  budget, 
of  course,  but  I’m 
sure  that  this  eco¬ 
nomic  downturn 
will  be  short-lived. 


on  travel  expenses  and 
the  cost  of  an  indepen¬ 
dent  contractor.  I'm  also 
looking  into  having  an 
engineer  in  India  conduct 
the  audits.  That  could  be 
doable  because  my  audit 
methodology  is  fairly 
streamlined  and  routine. 

Finally,  I'm  going  to 
stop  paying  maintenance 


ramp  up  our  security  pro¬ 
gram  again,  returning  it  to 
a  more  meaningful  level.  ■ 

•  This  week’s  journal  is  writ¬ 
ten  by  a  real  security  man¬ 
ager.  “Mathias  Thurman," 
whose  name  and  employer 
have  been  disguised  for 
obvious  reasons.  Contact 
him  at  mathias_thurman@ 
yahoo.com. 
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Bart  Perkins 


Boutique  Bound? 


bottom  of  the  pecking  or¬ 
der.  Avoid  disappointment 

S  A  RESULT  of  the  shaky  economy,  many  IT  pro-  by  adjusting  your  attitude 

fessionals  have  recently  lost  their  jobs,  and  more  ^-nnwriii impact,  with 
layoffs  lurk  ahead.  Many  tech  workers  will  consid-  lower  overhead  than  big- 

er  joining  or  forming  small  boutique  consulting  bquesareveryprofiwbie 
firms  with  staffs  ranging  from  one  to  50  employees.  when  everyone  is  working 


than  an  established 
consultancy.  Boutiques 
(particularly  those  with 
only  one  or  two  people) 


ers.  If  you  hate  the  selling 
process  or  quake  at  the 
thought  of  making  cold 


.  .  ger  consultancies,  bou- 

[Ue  consulting  tiques  are  very  profitable 

OyeeS.  When  everyone  is  working 

on  billable  projects.  But 

implement  their  ideas;  boutiques  may  experience 
■y  must  sell  them.  This  large  cycles  of  feast  and 
luires  collaboration  famine,  and  most  have 

th  the  client  and  a  will-  limited  funding  to  pay  the 
[ness  to  have  your  ideas  staff  during  idle  periods, 
idified.  If  your  ego  can’t  Be  prepared  financially. 


know  they  exist.  Often,  ■  Most  boutiques 
when  people  start  a  firm,  fakp  tU-  nncitinn 
friends  hire  them.  This  will  2****™™1 

jump-start  a  boutique,  but  "  Y00  Want 

it  won't  create  a  sustainable  3  Staff  meeting, 
company.  The  firm  must  look  in  the  mirror. 


consultants  beyond  basic  portunities  before  deciding 
levels.  Expect  cramped  if  you’re  boutique  bound.  ■ 
office  space  with  inconsis-  Bart  Perkins  is  managing 
tent  network  access.  Don’t  partner  at  Louisville.  Ky- 
expect  the  client  to  take  based  Leverage  Partners 
you  to  dinner.  Instead,  Inc.,  which  helps  organiza- 
expect  your  schedule  to  be  tions  invest  well  in  IT.  Con- 
inconveniently  rearranged  tact  him  at  BartPerkins@ 
on  short  notice.  (Learn  to  LeveragePartners.com. 


JANUARY  19, ; 


COMRUTERWORLD  35 


{  /A X \  Y 1  Who  Are  You? 

. JL.  Survey  finds  IT  pros  worldwide  hate  workplace  politics 


Steve  King 

Virtela  Com¬ 
munications  Inc. 


What  mistakes  do  first-tini 
tech  CEOs  commonly  com¬ 
mit  when  launching  a  bush 
ness?  The  No.  1  mistake  is  tryin 


What  advice  would  you  c 
aspiring  technology  entr 
preneurs,  particularly  th 
with  a  predominantly  tec 
nical  background?  First  a: 
foremost,  you've  got  to  surrou 


Survey  finds  IT  pros  worldwide  hate  workplace  politics 
-  and  love  the  History  Channel 
Havina  an  antitude  for  technoloav  seems  like  a  nnnd  nrerm- 
uisite  for  an  IT  professional,  but  how  about  having  a  thing  for 
the  Eagles  song  “Hotel  California-?  Both  show  up  as  common  at- 
tributes  in  a  wide-ranging  survey  conducted  by  online  community  ITtoolbox 
and  PJA  Advertising  &  Marketing.  Besides  asking  about  the  work-related 
issuesbelow.thesurveypriedinto  areas  like  favorite  books  (The  Bible  was 
No.  1.  followed  by  the  Harry  Potter  series,  but  business  titles  like  7  Habits  ol 
Highly  Effective  People  and  7he  Woridls  flat  also  made  the  top  10).  consumer 
technology  that  IT  pros  would  most  like  to  own  (Blu-ray  players),  politics  and 
preferred  TV  channels  (the  History  Channel  was  No.  1.  followed  by  CNN  and 
ESPNJ.Whenitcomesto  favorite  songs,  the  respondents  showed  a  clear 
preference  tor  hits  from  the  70s  and  emo:  the  only  contemporary  songs  in  the 
top  10  were  two  by  Coldplay.  No.  8.  Pink  Floyd's  "Comfortably  Numb."  was 
perhaps  the  response  of  several  hundred  people  who  thought  they  were  an¬ 
swering  the  question,  "How  do  you  feel  when  things  are  going  well  at  work?" 

How  do  you  feel  What  are  the  biggest 
when  things  are  going  headaches  you 
well  at  work?  experience  at  work? 

—  (Choose  up  to  three.) 

Company  politics 
get  in  the  way  of 

good  decision-making  51% 


ment  that's  going  to  buy  it. 
rother  thing  that's  difficult 
he  first-time  CEO  is  getting 


Which  of  the  following 
best  describe 
how  you  ended  up 
with  a  career  in  IT? 


How  do  you  most  lik 
to  be  rewarded 
for  success? 


•  that  you  can  analyze.  You're  not 
always  getting  the  straight  scoop 
from  your  team  because  either 


you're  applying  enough  bandwidth 
to  all  of  those  areas  as  a  CEO.  It's 
not  tor  everyone. 

-  THOMAS  HOFFMAN 

(tom.holfman24@gmail.com) 


right-brain  22.3%  1 

A  friend  encouraged  ” 


p1 ...  Validation 

™D  IC  .  and  praise  from 

recognition:  7%  colleagues 

-  Other:  1%  13% 
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Searching  for 
diverse  IT  Talent? 

_et  Computerworld  IT  careers 
Lit  your  recruitment  message  i 
front  of  over  1,400,000 
qualified  IT  professionals! 


CO-BRANDED 

EMAIL 

BLASTS 


Reach  your  targeted  audience  of  professional  IT  job  seekers 
with  Computerworld’s  Co-Branded  Email  Blasts.  This  unique 
program  allows  you  to  choose  your  criteria  of  100%  opt-in 
subscribers  by  geography,  company  size,  job  title  and  industry. 


Dawn  Cora  at  800.762.2977 


IT  CAREERS 


Are  you  frequently 
placing  legal  or 
immigration  advertisements? 

Let  us  help  you  put 
together  a  cost-effective 
program  that  will  make  this 
time-consuming  task  a 
little  easier! 


Place  your 

Labor  Certification  Ads  here! 
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SharKBnk 

TRUE  TALES  OF  IT  LIFE  AS  TOLD  TO  SHARKY 


Because  We  Care 

This  IT  shop  has  a  minicom¬ 
puter  that  keeps  failing  for 
no  apparent  reason.  “This 
had  been  going  on  for  three 
months”  reports  a  pilot  fish 
on  the  scene.  “Engineers  had 
been  out  to  check  the  ma¬ 
chine  and  could  find  nothing 
wrong.  One  day.  I  was  work¬ 
ing  behind  the  computer  and 
touched  the  main  400-volt 
connection  -  and  shot  two 
feet  backward.  I  then  went 
back  into  the  office,  shaking 
my  hand  to  remove  the  tin¬ 
gling  sensation,  and  proceed¬ 
ed  to  tell  my  boss  that  I  now 
knew  what  was  up  with  the 


the  comment  from  my  boss? 
-If  you  had  been  really  badly 
electrocuted,  we  would  have 
taken  you  outside,  put  you  up 
against  a  lamppost  and  sued 
thedty.'" 

Baby,  h’s  Cold  Inside 

Flash  back  to  the  1960s, 
when  this  pilot  fish  is  a  part- 


his  university.  “The  computer 
center  was  in  an  annex  off  the 
engineering  building,”  says 
fish.  “We  had  three  comput¬ 
ers  -  an  IBM  360/65,  IBM 
7044  and  IBM  1401.  which 
all  put  out  a  massive  amount 
of  heat  and  required  air  con¬ 
ditioning  24/7.  Since  I  was  a 
townie  and  everyone  else  was 
home  for  the  holidays,  I  had 
the  chore  of  working  Christ¬ 


mas  Eve  powering  everything 
down  and  reopening  at  6  a.m. 
on  the  26th.  Christmas  Eve 
was  bitterty  cold,  and  when  I 
opened  up  on  the  26th.  I  knew 
something  was  wrong  when 
I  could  see  my  breath  inside 
the  computer  room.  When  I 
powered  up  the  360/65, 1  was 
nearly  blinded  by  red  lights 
indicating  system  failures. 
Same  with  the  7044.  But  the 
trusty  1401,  which  was  used 
only  for  I/O.  powered  up  just 
fine.  It  served  as  an  electronic 
campfire,  around  which  I  sat 
making  desperate  calls  to 
every  engineer  on  the  call  list, 
asking  for  help.  Turns  out  that 
since  we  were  operating  24/7 

one  had  given  much  thought 
to  supplying  heat  to  the  com¬ 
puter  room!” 

Blackout 

It's  the  mid-1980s,  and  the 
mainframe  programmers  in 
this  IT  shop  all  use  green- 
screen  terminals.  “The  guy 
next  to  me  came  in  and  bred 


up  his  terminal,  but  the  screen 
stayed  dark,'  says  a  pilot  fish 
there.  ‘After  checking  the  ca- 


the  CRT  was  bad.  A  new  CRT 
was  brought  in,  and  it  worked. 
As  the  tech  was  taking  away 
the  defective  CRT,  he  asked. 
‘Do  you  want  your  glare  pro¬ 
tector?' He  pulled  the  Velcro- 
connected  glare  protector  off 
the  old  CRT.  and  a  black  sheet 
of  paper  fell  out  from  behind. 
We  never  found  out  who 
among  the  50  programmers 


■  Sharky  won’t  tell  anyone 
who’s  responsible/or  you r  true 
tale  of  IT  life.  Send  it  to  me  at 


<1  DO  YOU  LOVE  SHARK  TANK? 

Then  you  might  fee  Shark  Bat.  loo  . 

Diva  In  and  dsh  the 


yes and agnte tarStarkTank hone  , 


OH,  NOT  AGAIN.  Last  week,  the  SANS  Institute 
and  Mitre  released  yet  another  list  of  the  most  se¬ 
rious  programming  errors  that  break  software  se¬ 
curity.  And  this  time,  SANS  and  Mitre  got  dozens 
of  other  organizations  to  sign  on,  including  Microsoft,  Apple, 
Oracle,  Tata,  Symantec,  the  Department  of  Homeland  Securi¬ 
ty  and  the  National  Security  Agency. 

But  no  matter  how  good  it  is,  a  list  won’t  solve  this  problem. 


>  a  fine  list.  It 
includes  all  our  old  favor¬ 
ites:  overflowing  buffers, 
unchecked  input,  random 
numbers  that  aren’t  really 
random,  failure  to  block 
cross-site  scripting  and 
SQL  injection.  (You  can 
find  the  complete  list  at 
www.sans.org/top2Serrors.) 

Trouble  is,  we’ve  seen 
lists  like  these  before.  Se¬ 
curity  groups  have  been 
issuing  them  for  decades 
—  and  nothing  much  has 
changed. 

SANS  and  Mitre  say 
this  one  is  better,  because 
this  time  they  tapped  doz¬ 
ens  of  other  organizations 
to  help  compile  the  top  25 
programming  problems. 
Surely  that  will  convince 
programmers  to  see  the 
error  of  their  ways  and 
start  coding  securely, 
won’t  it? 

No,  it  won’t.  Program¬ 
mers  who  care  about  se¬ 
curity  don't  need  this  new 
list.  They  already  know 
about  these  problems  and 
work  to  avoid  them. 


And  programmers  who 
don’t  care  about  security 
won’t  even  notice  the  new 
list.  They  figure  security 
is  somebody  else’s  job. 

But  this  list  isn’t  a 
complete  waste.  There’s 
the  germ  of  a  new  idea 
here  —  and  if  we’re  really 
lucky,  SANS  and  Mitre 
will  make  it  a  reality. 

One  of  the  goals  for  this 
new  list  is  that  big  soft¬ 
ware  buyers  will  be  able 
to  use  it  to  improve  soft¬ 
ware  quality.  For  example, 
SANS  says  some  state 
governments  are  already 
thinking  about  requiring 
software  suppliers  to  cer¬ 
tify  in  writing  that  their 
code  is  free  of  the  errors 

Self-certification?  Yeah, 
good  luck  with  that. 

■  There’s  the  germ 
of  a  new  idea  here 
-  and  if  we’re  real¬ 
ly  lucky,  SANS  and 
Mitre  will  make  it  a 
reality. 


But  wait  — there’s  nt 
special  reason  why  any 
buyer  should  have  to  trusl 
a  software  provider’s  word 
that  the  code  is  clean.  Why 
not  make  third-party  ct 
fication  the  standard?  Cer¬ 
tification  companies  could 
get  access  to  the  source 
code,  run  automated  code 
checks  and  provide  reli¬ 
able  results  to  software 
buyers  about  how  clean 
the  code  really  is. 

Of  course,  the  reliabil¬ 
ity  of  those  third-party 
certifiers  would  depend 
on  the  quality  of  their  test 
suites.  If  every  certifier 
gins  up  its  own  tests,  that 
quality  could  be  all  over 
the  map. 

But  it  doesn’t  have  to  be 
—  not  if  SANS  and  Mitre 
and  their  partners  sponsor 
development  of  a  standard 
test  suite  and  then  make  it 
freely  available. 

Think  about  it.  Those 
third-party  certification 
companies  would  gladly 
use  that  test  suite,  because 
the  certifiers  would  be  off 


Software  providers 
would  happily  use  the  test 
suite  to  make  sure  then- 
code  would  achieve  third- 
party  certification  on  the 
first  pass. 

Security  companies 
would  fall  all  over  them¬ 
selves  to  discover  top-25 
errors  that  could  get  past 
the  test  suite.  They’d  issue 
their  press  releases,  the  test 
suite  would  be  updated, 
and  the  new  version  would 
be  the  new  standard. 

Companies  that  cur¬ 
rently  make  software 
testing  tools?  They  could 
integrate  the  top-25  test 
suite  with  their  own  prod¬ 
ucts,  which  customers 
would  still  buy  for  all  the 
other  code  problems  that 
those  products  catch. 

And  corporate  IT  shops 
that  think  they  can’t  af¬ 
ford  testing  tools?  They’d 
have  no  excuse  not  to  use 
the  free  top-25  test  suite. 

Developing  that  suite 
wouldn’t  be  easy  —  tech¬ 
nically  or  politically.  But 
SANS  and  Mitre  have 
already  lined  up  the  big 
players  who  can  help  make 
it  happen.  This  is  their 
chance  to  make  more- 
secure  software  a  reality. 

That  would  sure  beat 
yet  another  list.  ■ 

Frank  Hayes  is  Computer- 
world’s  senior  news 
columnist.  Contact  him 
atfrank_hayes@ 
computerworld.com. 
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